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We extend the security proof for continuous variable quantum key distribution protocols using post 
selection to account for arbitrary eavesdropping attacks by employing the concept of an equivalent 
protocol where the post-selection is implemented as a series of quantum operations including a 
virtual distillation. We introduce a particular 'Gaussian' post selection and demonstrate that the 
security can be calculated using only experimentally accessible quantities. Finally we explicitly 
evaluate the performance for the case of a noisy Gaussian channel in the limit of unbounded key 
length and find improvements over all pre-existing continuous variable protocols in realistic regimes. 



Quantum key distribution (QKD) is the process of gen- 
erating a common random key between two parties us- 
ing a quantum communications protocol. The power of 
this method is that the security of the key distribution, 
and the subsequent communication via a one time pad, 
is established while making no assumptions about the 
technological capabilities of a eavesdropper. This proce- 
dure also has the distinction of being the most developed 
quantum information technology pQ. 

There are two main flavours of QKD, discrete variable 
(DV) and continuous variable (CV) which are realised 
by encoding and then detecting: single photons [2] or 
the quadrature variables of the optical field [3j respec- 
tively. The latter kind, which we shall consider here, has 
the advantage of higher raw bit rates due to the high ef- 
ficiency and high bandwidth of homodyne detection and 
ease of integration with existing communications infras- 
tructure. CV protocols that employ post-selection [1] - 
a classical filtering of the measurement results - enjoy 
additional advantages in terms of versatility and recon- 
ciliation efficiency. 

Asymptotic (in the sense of string length) uncondi- 
tional security for protocols that do not employ post- 
selection is achieved by first noting the equivalence of 
an experimentally implemented prepare and measure 
(P&M) scheme to an entanglement based (EB) version 
[5] , followed by the result that for collective attacks secu- 
rity may be bounded from below by assuming the entan- 
gled state at the end of the protocol is Gaussian[Sl[7j and 
finally a proof that collective attacks are asymptotically 
optimal [8]- However for protocols using post-selection 
(PS) this analysis cannot be straightforwardly applied as 
an equivalent entanglement based picture has yet to be 
constructed, with security only shown under the assump- 
tion of a Gaussian eavesdropping attack [5] . 

Here we fill this gap and hence demonstrate uncondi- 
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tional security for post-selected CVQKD following the 
proof method used in In particular we construct 
an EB scheme in which the post-selection is replaced 
by equivalent heralded state transformations. We show 
we are able to straightforwardly construct the necessary 
parameters of this EB scheme from experimental data 
providing a realistically obtainable bound for the case 
of collective attacks and hence asymptotically uncondi- 
tional security. 

Security of CVQKD. — In general one equates each pro- 
tocol in which: the sender (Alice) prepares an ensemble 
of quantum states based upon a classical random prob- 
ability distribution and sends it through the domain of 
the eavesdropper (Eve) to the recipient (Bob), to an en- 
tanglement based scheme in which: Alice prepares an 
entangled state one half of which is kept and used for 
a projective measurement; and the other is transmitted 
to Bob again through Eves domain. The proper choice 
of the initial entangled state and the projective measure- 
ment by Alice allows us to rigorously express any prepare 
and measure schemes [5]. 

Bob makes a quadrature measurement upon his re- 
ceived states and then Alice and Bob engage in a recon- 
ciliation procedure to correct the errors in their shared 
classical string. The secret key rate for the entire proto- 
col is then given by 

K = (3I(a : b) — I(E : X), X e {a,b} (1) 

where I(a : b) is the Shannon mutual information be- 
tween classical strings belonging to Alice and Bob at the 
end of the protocol, (3 is the efficiency of their reconcil- 
iation procedure and I{E : X) is the quantum mutual 
information between either Eve and Bob if considering 
reverse reconciliation protocols or Eve and Alice if con- 
sidering direct reconciliation. 

Eve's mutual information is given by the purification 
of the entangled state before and after Alice or Bob's 
measurement. For example the direct reconciliation ex- 
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pression is [7] 

I(E : A) = S( PE ) - S( PE \a) = S(p AB ) - S(p B \a) (2) 

with the von Neumann entropy given by S(p) = 
tr(plogp) and for the second equality we have used the 
fact that the overall tripartite state \ABE) is pure. This 
quantity is not easy to calculate in general but it has 
been shown that we may bound the expression from be- 
low by analysing a Gaussian (HJ [7] , symmetric [TH] state 
with the same first and second moments. For Gaussian 
states, the von Neumann entropy is obtained straightfor- 
wardly and thus the security of the entire protocol can 
be characterised entirely by the covariance matrix of the 
entangled state shared by Alice and Bob. 

Equivalent post-selection scheme. — While reverse rec- 
onciliation can be shown to to be secure for arbitrary 
losses in the absence of noise, for any non-zero amount of 
excess noise the secure distance is inevitably finite. One 
could attempt to address this by increasing the input sig- 
nal modulation however any imperfection in the reconcil- 
iation process (/? < 1) means optimising the modulation 
can also only lead to a finite improvement. On the other 
hand direct reconciliation is significantly more tolerant 
to excess noise but only successful when the channel loss 
is below 50% or 3 dB. 

All of these detrimental effects can be improved us- 
ing post-selection [3], a technique in which values in the 
space of Bob's possible quadrature measurement results 
and Alice's quadrature encoding are probabilistically re- 
weighted and only these new distributions are kept to 
form the key. Intuitively one would expect this strategy 
to yield an advantage as the eavesdropper is effectively 
shut out of Alice and Bob's post-measurement collabo- 
ration. This improved performance comes at the price of 
not being able to directly apply Eq. ^ as this would 
not allow for Eve's knowledge of Alice and Bob's post- 
selection. This can be accounted for as long as one can 
keep track of the way post-selection by one party influ- 
ences the state of the other in the equivalent EB scheme 
which we shall now demonstrate. 

In general one post selects by applying a weighting 
function to achieve a new probability distribution in the 

PS 

chosen measurement basis, p(x) — > w(x)p(x) = p'(x). 
The normalisation of p' (x) gives the amount of data re- 
tained while transitioning from the initial to the post- 
selected ensemble. Alternatively one could apply an 
appropriate transformation consisting of a unitary act- 
ing on the mode in question together with auxiliary 
mode(s) which are subsequently traced out. A use- 
ful post-selection will correspond in the EB scheme to 
achieving some amount of distillation of the virtual en- 
tanglement, inevitably along with some additional noise. 
In this setting, FigJIJ the probabilistic nature of the post 
selection corresponds to Bob's first operation Ups being 
a non-deterministic but heralded operation (the distilla- 
tion) followed by appropriate deterministic unitary in- 
teractions corresponding to the noise addition and Bob's 
final measurement. 
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FIG. 1: Equivalent entanglement based version of a post- 
selected protocol. Alice distributes one arm of an entangled 
state through Eve's domain to Bob and makes a projective 
measurement Ua (giving classic output a) corresponding to 
an ensemble of states sent in a prepare and measure scheme. 
Bob passes his arm first through a device that probabilis- 
tically distills entanglement, Ups, and then makes a poten- 
tially noisy measurement Ub giving classical output bps- The 
heralding signal of U ps (h) is given to Eve but the remaining 
ancillae are kept within the stations of Alice and Bob. 



In this picture Eve's additional knowledge of the form 
of Alice and Bob's post selection is reflected by the state 
Pab in Eq. ([2| being identified with the state conditioned 
on successful heralding of Bob's first operation, i.e. the 
state after Ups but before Up- After all ancillae are 
traced over the outputs of Ua and Ub give classical 
strings a and bps which exactly match the experimen- 
tal results for the post selected ensemble. Note that we 
will be considering the secure station scenario where the 
ancillae remaining within the laboratories of Alice and 
Bob will not be attributed to the eavesdropper. 

The worst case scenario would correspond to the final 
state being Gaussian [5J [7J so if one is able to uniquely 
identify a Gaussian collection of unitaries and ancillae 
that result in the same measurement statistics then the 
key rate of that state will be provide a lower bound for 
the post-selected protocol. Denoting a successful run of 
the distillation as the outcome s and the resultant state 

p p s = trlS!w/ s i one m& y write < 



Ips(A : E) = S(p PS 
<S(p 



ps) 



- S(p PS \a) 
S( P $s\a), 



(3) 



where pp S is a Gaussian state with the same covariance 
matrix. This method is applicable to any form of post- 
selection, however demonstrating that the covariance ma- 
trix of the equivalent Gaussian setup can be obtained 
from measured data is non-trivial and may be more or 
less experimentally demanding (in terms of the number 
of measurements) depending upon the particular form of 
the post-selection. 

Gaussian post-selection. — We shall consider a partic- 
ular P&M scheme, Fig. [2] panel a), in which Alice draws 
values (xa,Pa) from a bivariate Gaussian of mean and 
variance Va and uses these numbers to modulate the vac- 
uum to create an ensemble of coherent states of the form 
\xa + ipA) which she sends to Bob through a quantum 
channel. Bob uses homodyne detection on his received 
states, randomly switching between quadratures given 
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FIG. 2: Prepare and measure and entanglement based ver- 
sions of a protocol using Gaussian post-selection, a) P&M 
scheme: Alice uses two classical Gaussian strings (xa,Pa) to 
prepare and transmit an ensemble of coherent states to Bob 
who homodyne detects and then applies a Gaussian weight- 
ing function, b) Equivalent EB scheme: Alice distributes one 
arm of an EPR pair and makes a heterodyne measurement ob- 
taining measurement results directly proportional to (xa,Pa)- 
Bob first passes his arm through an NLA, classically amplifies 
via a vacuum seeded two-mode squeezer (TMS) then mixes 
his mode with one arm of another entangled pair (EPRs) on 
a beamsplitter. He finally homodyne detects and obtains ex- 
actly the measurement results from the P&M scheme. The 
heralding signal of the NLA is given to Eve but the unmea- 
sured ancillae are kept within Bob's station. 
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and p = i(a' — a) where we have nor- 



malised the vacuum noise to unity. Bob then filters his 
results with the goal of selecting an ensemble which is 
a Gaussian distribution with a certain target variance 
Vps- For the most common case of a Gaussian channel 
Bob's input distribution is another Gaussian of variance 
Vb and the appropriate weighting function would look 
like w(x) = y/Vs/Vps exp{-x 2 (l/V PS - 1/Vb)). In the 
relevant case Vps > Vb this function is convex so in 
order to arrive at a proper probability distribution we 
will choose some endpoints ±A, renormalise the func- 
tion to the value at this point and set all values outside 
this range to unity. For a Gaussian input state the exact 
filter function is 



W(x) = N 1 + 



1 (Q(x + A) — Q(x - A)) 



w(x) 
w(A) 

(4) 

where O(x) is the Heaviside step function and the frac- 
tion of data kept is the re-normalisation N. When A 
is this operation is the identity. As A — > oo it re- 
sults in a Gaussian distribution of variance Vps and in 
between give a slightly non-Gaussian state with variance 
Vb < V < Vps- Finally Alice and Bob publicly announce 
a subset of their data to characterise the covariance ma- 
trix on both the initial and post-selected ensemble and, if 
secure, engage in reconciliation and privacy amplification 
to distill a completely secure key. Notice that although 
the weight function is smooth instead of hard edged it is 
determined entirely by Bob and the only information he 
sends to Alice is a 'keep or reject' signal. 

The equivalent entanglement based scheme, Fig. [2] 



panel b), involves Alice preparing a two-mode squeezed 
vacuum or EPR state, one mode of which she keeps 
and measures, the other being transmitted to Bob. 
Alice's makes a heterodyne detection whereas Bob's 
measurement, depending upon the target variance, de- 
composes into a combination of a noiseless amplifica- 
tion/distillation followed by classical amplification and 
finally some additional noise. The necessary Gaussian en- 
tanglement distillation is achieved via the noiseless linear 
amplifier (NLA) (TlJ [12] with the classical amplifier and 
additional noise corresponding to a two-mode squeezer 
with vacuum ancilla and a beamsplitter with an EPR 
pair ancilla respectively. If we can uniquely characterise 
Gaussian operations that perform the necessary trans- 
formations from the transmitted to the post-selected en- 
semble at the level of the covariance matrix then we can 
apply the above proof and determine the security. 

To illustrate this method we evaluate performance for 
the most common case, the noisy Gaussian channel. Such 
a channel is completely parameterised by it's transmis- 
sion T and excess thermal noise £ [13] . One can calculate 
the action of an NLA on an EPR state sent through a 
general Gaussian channel O [T3] with the result being 
an effective protocol where stronger entanglement was 
distributed through a channel with less loss but greater 
excess noise, leading to an overall advantage. Inverting 
the relationship for the effective entanglement generated 
gives a relationship, 
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T(V A (2 + Vf s - + V£ s 



(5) 



that uniquely identifies the gain of the NLA based only 
upon the measured channel parameters and Alice's mod- 
ulation variance before and after after post-selection. 
Bob and Alice's other operations are just beamsplitters 
and two-mode squeezing, their effect on the covariance 
matrix being given by the appropriate symplectic trans- 
formations 16J. Given Alice and Bob's measurement of 
the covariance matrix before and after the post-selection 
straightforward algebra allows us to characterise all pa- 
rameters in Fig(2] and thus unconditionally bound Eve's 
information via Eq.Q. For this form of post-selection, 
the resultant distributions turn out to be extremely close 
to Gaussian, so we have the option of making use of re- 
cent improvements in the reconciliation efficiency Gaus- 
sian variables [T7] as well as the sign encoding of [3] and 
we will choose the former case here. See [13] for a de- 
tailed calculation of these quantities and the secret key 
rate. The crucial tradeoff in this scheme is between a 
large post-selection to improve the effective channel and 
the proportion of measurement results that are discarded. 

We plot the key rate as a function of distance of a 
coherent state homodyne protocol, Figj3] for both di- 
rect and reverse reconciliation along with the case with- 
out post-selection for comparison. In all plots the rec- 
onciliation efficiency is taken to be a constant value of 
(3 = 0.9 and for each point Alice's modulation variance is 
independently optimised for each protocol along with the 
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Loss(dB) 

FIG. 3: Improvement in secret key rates due to Gaussian 
post-selection, a) Direct reconciliation with post-selection 
(solid lines) and without (dashed lines) as a function of loss for 
£ = {0.1, 0.2, 0.3} with decreasing key rate, b) Reverse recon- 
ciliation with post-selection (solid lines) and without (dashed 
lines) as a function of loss for £ = {0.02,0.03,0.05} with de- 
creasing key rate. For all plots ft — 0.9. 



parameters (A,Vps) f° r the post-selected scheme. Fur- 
thermore for the case without post-selection we included 
the potential to optimise over a deterministic addition of 
noise as outlined in [18]. For these realistic experimental 



parameters the post-selection protocol allows for secure 
key generation over long distances (in combination with 
RR) and for greater excess noise (in combination with 
DR) than any previous coherent state protocol. Finally 
the presence of an NLA in the effective Gaussian circuit 
leads one to compare these results with those of [15] . We 
find that almost all of the improvements shown there are 
recovered by our classical post-processing scheme. This 
leads one to conclude that an NLA placed just before 
Bob's detectors will not lead to a benefit for QKD over 
and above that of a post-selection scheme. 

Conclusions. — 

In conclusion we have shown that post-selection based 
CVQKD is secure for arbitrary collective attacks, and 
thus asymptotically secure for all attacks. This was 
achieved by identifying an entanglement based scheme 
that correctly reflects the post-selected ensemble that is 
used in the final key generation. Furthermore results for a 
particular Gaussian form of post-selection show improve- 
ments in performance over all previous coherent state 
protocols for certain relevant combinations of loss and 
noise. Avenues for further work, include the investiga- 
tion of other post-selection filters with a view to proving 
which is optimal, the incorporation of finite-size effects 
and the combination of post-selection with other proto- 
cols to identify the optimal technique for a given scenario. 
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We have recently become aware of independent work 
on virtual noiseless amplification in CVQKD [19] , 



[1] V. Scarani, H. Bechmann-Pasquinucci, N. Cerf, 
M. Dusek, N. Liitkenhaus, and M. Peev, Rev. Mod. Phys. 
81, 1301 (2009). 

[2] Y. Zhao and H.-K. Lo, arXiv quant-ph (2008), 
0803.2507v4. 

[3] N. Cerf and P. Grangier, JOSA B 24, 324 (2007). 

[4] C. Silberhorn, T. Ralph, N. Liitkenhaus, and G. Leuchs, 

Phys. Rev. Lett. 89, 167901 (2002). 
[5] F. Grosshans, N. Cerf, P. Grangier, J. Wenger, and 

R. Tualle-Brouri, Quantum Inf. Comput. 3, 535 (2003). 
[6] M. Navascues, F. Grosshans, and A. Acm, Phys. Rev. 

Lett. 97, 190502 (2006). 
[7] R. Garci'a-Patron and N. Cerf, Phys. Rev. Lett. 97, 

190503 (2006). 

[8] R. Renner and J. Cirac, Phys. Rev. Lett. 102, 110504 
(2009). 

[9] M. Heid and N. Liitkenhaus, Phys. Rev. A 76, 022313 
(2007). 

[10] A. Leverrier, E. Karpov, P. Grangier, and N. Cerf, New 
Journal of Physics 11, 115009 (2009). 



[11] T. Ralph and A. Lund, Quantum Communication Mea- 
surement and Computing Proceedings of 9th Interna- 
tional Conference p. 155 (2009). 

[12] G. Xiang, T. Ralph, A. Lund, N. Walk, and G. Pryde, 
Nature Photonics 4, 316 (2010). 

[13] Note that this is the excess noise referred to the input 
as opposed to the quantity T£ that would be directly 
measured by Bob. 

[14] Supplementary Material. 

[15] R. Blandino, A. Leverrier, M. Barbieri, J. Etesse, 

P. Grangier, and R. Tualle-Brouri, arXiv quant-ph 

(2012), 1205.0959vl. 
[16] C. Weedbrook, S. Pirandola, R. Garci'a-Patron, N. Cerf, 

T. Ralph, J. Shapiro, and S. Lloyd, Rev. Mod. Phys. 84, 

621 (2012). 

[17] P. Jouguet, S. Kunz-Jacques, and A. Leverrier, Physical 

Review A 84, 062317 (2011). 
[18] R. Garcfa-Patron and N. Cerf, Physical Review Letters 

102, 130501 (2009). 
[19] J. Fiurasek and N. J. Cerf, arXiv quant-ph (2012), 



5 



1205.6933vl. 

[20] A. Leverrier and P. Grangier, Phy. Rev. A 83, 042312 
(2011). 

[21] A. Serafini, Physical Review Letters 96, 110402 (2006). 



Appendix A: Parameter Estimation 

A crucial step in all cryptographic schemes is the esti- 
mation of parameters which form the basis for quantita- 
tive analysis of security. A further complication is that 
for many QKD protocols, including the scheme investi- 
gated in this Letter, security is actually calculated on a 
related entanglement based version. Thus it is important 
to establish that the parameters measured in the exper- 
imental implementation are sufficient to characterise the 
appropriate entangled state. 

From a purely theoretical point of view, an appropri- 
ate entangled state would be any two-mode state such 
that Alice's projective measurement results in exactly the 
same key-generating states as seen by Bob and Eve. This 
means that for any given experiment there exist multiple 
options for an equivalent entangled state. However some 
are much more attractive than others for the purposes 
of parameter estimation. Here we shall first go through 
the procedure for estimating the necessary quantities us- 
ing only experimentally accessible data for the canonical 
Gaussian protocols and then show that a similar pro- 
cedure exists for the scheme outlined in this letter. In 
the all Gaussian CVQKD protocols the procedure is rel- 
atively straightforward. One is interested in estimating 
a covariance matrix (CM) of the form 



lAB 



a h 



c a z 
b I 2 



where h = [1,0; 0,1], a z = [1,0; 0,-1]. The block form 
is justified with the use of symmetry arguments as out- 
lined in [10[ I20j and thus one must only know 3 param- 
eters. The experimentally available information consists 
of 2 classical strings: the quadrature displacements of 
the coherent states created by Alice and the quadrature 
measurements made by Bob. From these one can com- 
pute 2 variances and a covariance which will give us the 
3 required parameters as shown below. In all following 
discussion the vacuum noise is normalised to unity. The 
canonical choice of entangled purification for the Gaus- 
sian ensemble of coherent states sent by Alice is an EPR 
pair [5] which has a covariance matrix of the form Al 
with entries a = b = Va + 1 and c = \/Vj[+ 2Va where 
Va is Alice's modulation variance in the P&M scheme. 

After transmission Alice and Bob will measure the CM 
of the de-cohered EPR and interpreting these as corre- 
sponding to an effective Gaussian channel paramaterised 
by T and £ can express the entries as a = Va + I, 
b = TV A + T£ + 1 and c = y/T(V^ + 2V A ). 

Up to this point Alice and Bob follow exactly the 
same procedure for our new protocol. Then, after they 
apply the post-selection filter they repeat this process 



to measure another CM, jps, with entries given by 
a = VP + I, b = T PS VP + T PS £ PS + 1 and c = 

^J T PS((yPSy + 2V% S ). Note that although we write 

down effective channel parameters the elements of the 
CM are directly measured and not assumed to take some 
form based upon the channel parameters. 

We now wish to determine the Gaussian operations 
within Bob's station that will result in the same statis- 
tics. These are an NLA gain g, a parametric amplifi- 
cation parameter rj and an EPR of variance Nb injected 
through a beamsplitter of transmission Tb ■ Inverting the 
expressions for the NLA derived below we can solve for 
the gain to find, 
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2(V 



PS 



T(V A (2 + VP - 



(A2) 



Substituting this gain into the transformations above we 
deduce a third covariance matrix of the state after the 
NLA, jnla, with entries QnlAi bNLAi &NLA of the same 
form as above . In general the Gaussian post-selection 
does not only simulate an NLA but acts to further am- 
plify the state and then add noise. Both these opera- 
tions are equivalent to unitary interactions with ancillae 
which are subsequently traced out. The amplification 
corresponds to interacting the incoming mode with the 
vacuum in a two-mode squeezer and the thermal noise is 
equivalent to mixing the incoming mode with one arm 
of an EPR pair on a beamsplitter. These operations 
between these last two covariance matrices can thus be 
compactly expressed via symplectic transformations, 



IPS 



BS T (T B )S T (77) 7jVLA S(r/)BS(T B ) (A3) 



(Al) where 



BS(T) = 



V 1 ! 1 Oz y/V h 



-a/1 - T l 2 VT I 2 



(A4) 



are the symplectic transformations for a two-mode 
squeezer and a beamsplitter respectively. Substituting 
In la an d "/ps leaves us with a matrix equation that can 
be solved for Tb, f] and Nb- The necessary relationships 



T B {N B + l)-N B = b PS 



U P5 

r 2 
NLA 



{l + b NL A) 



n 



-PS 



C NLA^B 



(A5) 



Strictly speaking there is a degeneracy between these pa- 
rameters in that there are combinations of values the 
three, however any combination consistent with the out- 
put statistics result in the same secret key rate. Thus we 
can construct all the necessary parameters to calculate 
the secret key rate based only upon the directly mea- 
sured elements of the covariance matrix before and after 
post-selection. 



() 



Appendix B: NLA: Application to CVQKD 

As described above the ensemble that Alice sends to 
Bob is equivalent to the preparation of an EPR pair of 
variance V = Va + 1 which in turn can be created by mix- 
ing appropriately squeezed states on a 50:50 beamsplit- 
ter. Furthermore transmission through a Gaussian chan- 
nel of parameters T and £ is also equivalent to interaction 
on a beamsplitter of transmission T with a second EPR 
created by Eve with variance given by Ne = 1 ~ 1 T 1 r T ^ . 
Thus we can calculate the effect of on NLA on a CVQKD 
system through a Gaussian channel by mixing two appro- 
priate EPR pairs and then applying the NLA to Bob's 
mode. 

The initial EPR states of Alice and Eve can be written 
in the x quadrature basis, 



where the squeezing variances are related to the PSzM 
parameters by V s = e acosh(VA+ ^ and = e^M-^) 
and in all integrals dxi to to be taken to run over all 
mode variables present. These modes B and E\ are then 
mixed on a beamsplitter of transmission T with one out- 
put being sent to Bob and the other retained by Eve. 
If we transform to the Hilbert space belonging to Alice 
Bob and Eve at the end of the protocol the appropriate 
change of variables allows us to write the final shared 
state as, 



\ABE) 



2tt 



d 2 Xi ip(xi) \x A ) \xe 2 ) \xe-l) 



\AB) = 



1 



'2lt 



1 (»A-*B) 1/ . \2,r 

5 vl, e --a(xA+x B ) V s 



d 2 X4 e s v s e 



xa) \xb) 



V27T J 



1p(Xi) 




V2 



V2 



''- T5 v i (-v / 2 v / T rr T^B + v / 2v / Tx El - V2x E2 ) 2 - 



(B2) 



We consider a non-deterministic amplification opera- 
tor of a fixed intensity gain g that acts upon Fock states 
according to \n) = g? \n). For compactness we will 
suppress all kets except for Bob's mode where the NLA 
is to be applied. Applying the NLA to our state we in- 
sert a number state resolution of the identity, apply the 
NLA and then transform back to the quadrature basis 
via another resolution of the identity, 



\ABE) = / dx ip{x)g? \x) 

OO 

dx ip(x)^2gi 

n=0 
„ oo 

/ dx ip(x)^2g l - 

J n=0 

oo 

dxdy il>(x)Y i g*(n\x)(y\n) y /g n \tfpS) 



f= n {n x) 



r= n {n x) 



n=0 



For the summand we use the definition of a correctly nor- 
malised overlap between a number state and a quadrature 
state, 



(x\n) 



n {vy 



(27r)3 V / 2™n! 

where H n {x) = (— l) n e x j-^e~ x are the Hermite poly- 



nomials, to arrive at, 



oo 

E 

n=0 



'n\x){y\n) y /g n = ^ 



27r2 n n! 



Finally we make use of the following identity, 



y> H n (x)H n (y) 

n=0 



n 



_(B4) 
al- 



Substituting Eq.(|B4j) into Eq.(|B3| and then Eq.(|Bl] 
lows us to compute the elements of Alice and Bob's new 
covariance matrix via lengthy but straightforward inte- 
gration. The expressions for the elements themselves are 
cumbersome but the resultant expressions can be solved 
to give effective parameters that characterise an effec- 
tive EPR sent through an effective channel. To facilitate 
easy comparison with the previous work [111 112] we will 
rewrite the effective modulation variance as an ef fective 
EPR entanglement parameter related by % = y • 



7 



These effective parameters are given by, 



Alice and Bob Mutual Information 



X NLA 

rpNLA 



ar(i-g)) . 



4gT 



NLA 



(-2 + (-1 + g)T(-2 + 0)(-2 + (-1 + g)TO 
£-£T(£-2)( 5 -l)/2 (B5) 



An important sanity check is that in the iimit g — > 1 
these expressions simply return the input values and for 
£ = correspond to the results of fTTJ [TJ] . These results 
have been independently derived in j!5) by a different 
method, namely considering the action of the NLA on 
the thermal state that is Bob's output. 



Appendix C: Calculation of Key rate 

Now we have all the tools necessary to derive the key 
rate for the case of a noisy Gaussian channel utilising 
Gaussian post-selection. This is given by the difference 
in the mutual information between the two legitimate 
parties, and the reference party and the eavesdropper. 
First we need to calculate the covariance matrix of the 
post-selected ensemble. 

We recall that in the EB scheme if Alice were to make 
a heterodyne measurement of xa,Pa upon her arm of the 
EPR she would find a Gaussian distribution distribution 
with variance V = Va 2 +2 and would project Bob's arm 

into a coherent state centered at \J 2 Xv A ( x a>Pa)- After 
transmission Bob's receives displaced thermal states of 
variance V B = TV A + Tf + 1. Writing P(x A ,x B ) = 
P{xa)P{xb\x a ) we have for the conditional probability 
distribution, 



P(x A ,x B ) = 



e 2 + v a 



+ V A 



: A+ X B 



v^ttVI + T£V2 + V A 



(CI) 



As explained earlier Bob then applies a weighting func- 
tion given by 

W(x) = n(i + - l) (Q(x + A) - Q(x - A)) 

7 (C2) 
where w{x) = ^V B /V PS exp(~x 2 (l/Vp S - l/V B )), Q(x) 
is the Heaviside step function, A is a cutoff point and 
N is the renormalisation. Thus the post-selected joint 
probability distribution is given by 



Pps(x A ,x B ) = P(x Al x B )W{x B ) 



(C3) 



The fraction of data kept is the re-normalisation N^ 1 = 
J dxAdx B P(xA,x B )W(x B ). For the post-selected co- 
variance matrix the necessary moments, M (xa,x b ) — 
x a ,XaX B etc., are found by evaluating the integral 

(M(xa,x b )) = / dx A dx B Pps(xa,x b )M (xa,x b ()C4:) 



The maximum information Alice and Bob can extract 
from two correlated variables with joint probability dis- 
tribution P{x Al x B ) is given by Shannon's formula, 



I {a : b) = P(x A ,x B )log 



P(x A ,x B ) 
P(x A )P(x B ) 



(C5) 



where P(xa), P(x b ) are the marginal probability distri- 
butions and is the same for reverse and direct reconcilia- 
tion. In the case of Gaussian distributions this would re- 
duce to the familiar formula Ig{o- ■ b) = \ log(l + SNR). 
As outlined in the paper for a target variance Vps > V B 
there will be some values of A for which our distribu- 
tions will diverge from Gaussian but this non-Gaussianity 
turns out to be very small. Finding efficient reconcilia- 
tion codes to extract the maximum information is non- 
trivial but as the distributions that result from this proto- 
col are extremely close to Gaussian the recent promising 
advances in the reconciliation of Gaussian variables |17j 
should find application in this protocol. Alternatively 
Alice and Bob could also engage in a discretisation as 
outlined in [4]. 



2. Eve Mutual Information 

We will be bounding Eve's information by calculat- 
ing it for a Gaussian state with the measured CM. The 
Gaussian entropies can be calculated using, 

S(p) = ^(1 + A fc ) log(l + A fe ) - \ k log(Afc) 

k 

where are the symplectic eigenvalues of 7 p the covari- 
ance matrix of p. These can be calculated in for example, 
[TO] or in full generality |21) . 



a. Direct Reconciliation 



by, 



Eve's quantum information about Alice's data is given 



I(x A :E)=S(p^)-S(p^\x A ) 



(C6) 



Given that Eve purifies the state p^ s = Pa B - The co- 
variance matrix of p^g can be calculated directly from 
Eq.(C4| and is of the symmetric form Eq.(Al) with en- 



tries 



a = V 



PS 



b = T^V 



a rl 

PS-xrPS 



PScPS 



T PS {{VPY + 2VP S ) 



Alice then makes a heterodyne measurement introducing 
a vacuum mode C. Although Bob homodynes and thus 



the second mode is unused it is not given to Eve. Eve still 
purifiest the state after measurement so S{p^ \xX) = 
S(pbC\xa). Util ising the symplectic beamsplitter trans- 
formation in Eq.(A4) we find the covariance matrix is, 



lBC\x A 



a 





V2c 
a+l 




\ 





b 


c 


\/2c 





2a 





a+l 


a+l 


V o 


c 
V2 





a+l 
2 / 



(C7) 



by, 



Reverse Reconciliation 



Eve's quantum information about Bob's data is given 



I(x A : E) = S(p% B ) - S{p p E s \x B ) 



(C8) 



The first term is exactly the same as the direct recon- 
ciliation expression but the last is more complicated due 
to the additional operations in Bob's station. Bob has 



3 ancilla modes: a vacuum, mode D, for the two-mode 
squeezing interaction and an EPR of variance Nb , modes 
G and F. Before the measurement the full CM would be 



1ABDFG 



/al 2 
c a z 
Z 

z 
z 



b I 2 
Z 

z 
z 



z 
z 
h 
z 
z 



z 
z 
z 

N B I 2 



z 
z 
z 



N B I 



1 <j z 

2 



where is a 2 x 2 matrix of zeros. The states interact via 



Eq.(A3) and after Bob's measurement Eve still has the 
purification so S(p b s \xb) — S(j>bDFG\xb) where the 
covariance matrix is given by, 



/ 1A G AD CTAF f AG 

CAD JD CpD Z 

0"AF fFD IF CTpG 

V & AG Z a FG 7 G 



where, 



7A 



Id = 



If 



7g 



&ad — 



&AF 



& AG 



Cr)T B 
b)- 




" + N B {-1+T B )-l-1+V+bri)TB 







u \ 1 -r 'I) -rn^r NB (_ 1+TB) _ ( _ 1+v+bTl)TB 

b(-l + T])+T] 



(-l+ V +br))N E 







N B + (-l+n+bv-N B )T B 

-l + T] + bj]+(l-(l + b)r, + N B )TB 



N B 



(-i+a^)(~i+t b ) 

-A f f3 + (l-(l+6)j)+Af B )T i 3 U 

Nb 



cs/=T+rj(NB C-l+Tj; )+T B ) n 
N B +(-l+ri+bri-NB)TB 

Cy/-1 + T) 



n _ rp (-l+v+bn-N B )VT^^/~(,-l+T B )T B \ 
"V 1 J B+ NB + (-i +rl+brl - NB )T B I U 



c^fjy / -l+N% y /-(~l+T B )T B 
-N B + (l-{l+b) v +N B )T B 





(C9) 



Finally the secret key rate must be multiplied by the for direct and reverse reconciliation, 
fraction of the data kept in the post-selection process so 
the final key rate reads, 



K = N(f3I(a : b) — I(E : X)), X £ {a, b} (CIO) 



